Support Gitlab CI/CD as a trusted publisher #15583

harsh-ps-2003 · 2025-08-29T17:08:05Z

uv publish now supports GitLab CI as a Trusted Publishing provider.

woodruffw

Thanks @harsh-ps-2003! I think there's some stuff we could remove here, but the overall approach looks good to me.

One larger thought that this PR doesn't need to/shouldn't address: at some point it will probably make sense to abstract the OIDC token discovery, similarly to how the id package does for PyPI, twine, etc. That'll give uv the ability to add support for new Trusted Publishing providers without needing to know the internal details of how each expects credentials to be discovered. But that's a larger project.

crates/uv-static/src/env_vars.rs

crates/uv-publish/src/trusted_publishing.rs

- Updated test descriptions to reflect the use of {AUD}_ID_TOKEN for GitLab trusted publishing. - Replaced explicit OIDC token environment variable with audience-specific tokens (PYPI_ID_TOKEN, TESTPYPI_ID_TOKEN) in tests. - Removed the explicit OIDC token handling from the `get_token` function, now relying on audience-based token discovery. - Enhanced error handling to indicate missing environment variables for GitLab CI.

…ublishing tests

crates/uv-publish/src/trusted_publishing.rs

…y for audience-based OIDC tokens, improving clarity and consistency. - Introduced a new `normalize_env_key_audience` function to standardize audience strings into environment key components, ensuring uppercase ASCII and replacing non-alphanumeric characters with underscores. - Enhanced error handling for missing environment variables by providing a more generic error message.

crates/uv-publish/src/trusted_publishing.rs

woodruffw · 2025-09-08T15:47:39Z

Thanks for your hard work here @harsh-ps-2003! I've thought about this a bit more, and I think the approach we want to go with here is a larger architectural one: I'm going to build a "get an ambient OIDC credential" crate that'll abstract GitHub and GitLab OIDC retrieval, similar to what the id package in Python does. That'll make testing and future extensions (for other Trusted Publishing providers) much easier.

If you're OK with it, I'll take over this PR to make those changes. But if not, I'll start from scratch (and attribute you as a co-committer in my new changes).

harsh-ps-2003 · 2025-09-08T18:26:19Z

Thanks and please feel free to take over this PR! @woodruffw

Signed-off-by: William Woodruff <[email protected]>

crates/uv-publish/src/trusted_publishing.rs

woodruffw · 2025-09-09T20:56:30Z

crates/uv-publish/src/trusted_publishing.rs

+) -> Result<Option<ambient_id::IdToken>, TrustedPublishingError> {
+    let detector = ambient_id::Detector::new_with_client(client.clone());
+
+    Ok(detector.detect(audience).await?)


ambient_id now abstracts all of this 🙂

crates/uv-publish/src/lib.rs

Signed-off-by: William Woodruff <[email protected]>

woodruffw · 2025-09-09T21:08:55Z

This is good for a look -- I've rewritten the TP flow to use ambient_id (our new crate) for the OIDC discovery phase, which is both a nice simplification and makes adding support for other Trusted Publishing providers much easier in the future.

crates/uv/tests/it/publish.rs

crates/uv-publish/src/trusted_publishing.rs

Signed-off-by: William Woodruff <[email protected]>

woodruffw · 2025-09-10T15:46:42Z

(Current test failures look like flakes to me)

konstin

Can you update the PR description for the merge commit?

Signed-off-by: William Woodruff <[email protected]>

woodruffw · 2025-09-11T14:43:57Z

Thanks for your hard work here @harsh-ps-2003!

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [astral-sh/uv](https://github.com/astral-sh/uv) | patch | `0.8.17` -> `0.8.22` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>astral-sh/uv (astral-sh/uv)</summary> ### [`v0.8.22`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0822) [Compare Source](astral-sh/uv@0.8.21...0.8.22) Released on 2025-09-23. ##### Python - Upgrade Pyodide to 0.28.3 ([#15999](astral-sh/uv#15999)) ##### Security - Upgrade `astral-tokio-tar` to 0.5.5 which [hardens tar archive extraction](GHSA-3wgq-wrwc-vqmv) ([#16004](astral-sh/uv#16004)) ### [`v0.8.21`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0821) [Compare Source](astral-sh/uv@0.8.20...0.8.21) Released on 2025-09-23. ##### Enhancements - Refresh lockfile when `--refresh` is provided ([#15994](astral-sh/uv#15994)) ##### Preview features Add support for S3 request signing ([#15925](astral-sh/uv#15925)) ### [`v0.8.20`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0820) [Compare Source](astral-sh/uv@0.8.19...0.8.20) Released on 2025-09-22. ##### Enhancements - Add `--force` flag for `uv cache clean` ([#15992](astral-sh/uv#15992)) - Improve resolution errors with proxied packages ([#15200](astral-sh/uv#15200)) ##### Preview features - Allow upgrading pre-release versions of the same minor Python version ([#15959](astral-sh/uv#15959)) ##### Bug fixes - Hide `freethreaded+debug` Python downloads in `uv python list` ([#15985](astral-sh/uv#15985)) - Retain the cache lock and temporary caches during `uv run` and `uvx` ([#15990](astral-sh/uv#15990)) ##### Documentation - Add `package` level conflicts to the conflicting dependencies docs ([#15963](astral-sh/uv#15963)) - Document pyodide support ([#15962](astral-sh/uv#15962)) - Document support for free-threaded and debug Python versions ([#15961](astral-sh/uv#15961)) - Expand the contribution docs on issue selection ([#15966](astral-sh/uv#15966)) - Tweak title for viewing version in project guide ([#15964](astral-sh/uv#15964)) ### [`v0.8.19`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0819) [Compare Source](astral-sh/uv@0.8.18...0.8.19) Released on 2025-09-19. ##### Python - Add CPython 3.14.0rc3 - Upgrade OpenSSL to 3.5.3 See the [python-build-standalone release notes](https://github.com/astral-sh/python-build-standalone/releases/tag/20250918) for more details. ##### Bug fixes - Make `uv cache clean` parallel process safe ([#15888](astral-sh/uv#15888)) - Fix implied `platform_machine` marker for `win_arm64` platform tag ([#15921](astral-sh/uv#15921)) ### [`v0.8.18`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0818) [Compare Source](astral-sh/uv@0.8.17...0.8.18) Released on 2025-09-17. ##### Enhancements - Add PyG packages to torch backend ([#15911](astral-sh/uv#15911)) - Add handling for unnamed conda environments in base environment detection ([#15681](astral-sh/uv#15681)) - Allow selection of debug build interpreters ([#11520](astral-sh/uv#11520)) - Improve `uv init` defaults for native build backend cache keys ([#15705](astral-sh/uv#15705)) - Error when `pyproject.toml` target does not exist for dependency groups ([#15831](astral-sh/uv#15831)) - Infer check URL from publish URL when known ([#15886](astral-sh/uv#15886)) - Support Gitlab CI/CD as a trusted publisher ([#15583](astral-sh/uv#15583)) - Add GraalPy 25.0.0 with support for Python 3.12 ([#15900](astral-sh/uv#15900)) - Add `--no-clear` to `uv venv` to disable removal prompts ([#15795](astral-sh/uv#15795)) - Add conflict detection between `--only-group` and `--extra` flags ([#15788](astral-sh/uv#15788)) - Allow `[project]` to be missing from a `pyproject.toml` ([#14113](astral-sh/uv#14113)) - Always treat conda environments named `base` and `root` as base environments ([#15682](astral-sh/uv#15682)) - Improve log message when direct build for `uv_build` is skipped ([#15898](astral-sh/uv#15898)) - Log when the cache is disabled ([#15828](astral-sh/uv#15828)) - Show pyx organization name after authenticating ([#15823](astral-sh/uv#15823)) - Use `_CONDA_ROOT` to detect Conda base environments ([#15680](astral-sh/uv#15680)) - Include blake2b hash in `uv publish` upload form ([#15794](astral-sh/uv#15794)) - Fix misleading debug message when removing environments in `uv sync` ([#15881](astral-sh/uv#15881)) ##### Deprecations - Deprecate `tool.uv.dev-dependencies` ([#15469](astral-sh/uv#15469)) - Revert "feat(ci): build loongarch64 binaries in CI ([#15387](astral-sh/uv#15387))" ([#15820](astral-sh/uv#15820)) ##### Preview features - Propagate preview flag to client for `native-auth` feature ([#15872](astral-sh/uv#15872)) - Store native credentials for realms with the https scheme stripped ([#15879](astral-sh/uv#15879)) - Use the root index URL when retrieving credentials from the native store ([#15873](astral-sh/uv#15873)) ##### Bug fixes - Fix `uv sync --no-sources` not switching from editable to registry installations ([#15234](astral-sh/uv#15234)) - Avoid display of an empty string when a path is the working directory ([#15897](astral-sh/uv#15897)) - Allow cached environment reuse with `@latest` ([#15827](astral-sh/uv#15827)) - Allow escaping spaces in --env-file handling ([#15815](astral-sh/uv#15815)) - Avoid ANSI codes in debug! messages ([#15843](astral-sh/uv#15843)) - Improve BSD tag construction ([#15829](astral-sh/uv#15829)) - Include SHA when listing lockfile changes ([#15817](astral-sh/uv#15817)) - Invert the logic for determining if a path is a base conda environment ([#15679](astral-sh/uv#15679)) - Load credentials for explicit members when lowering ([#15844](astral-sh/uv#15844)) - Re-add `triton` as a torch backend package ([#15910](astral-sh/uv#15910)) - Respect `UV_INSECURE_NO_ZIP_VALIDATION=1` in duplicate header errors ([#15912](astral-sh/uv#15912)) ##### Documentation - Add GitHub Actions to PyPI trusted publishing example ([#15753](astral-sh/uv#15753)) - Add Coiled integration documentation ([#14430](astral-sh/uv#14430)) - Add verbose output to the getting help section ([#15915](astral-sh/uv#15915)) - Document `NO_PROXY` support ([#15816](astral-sh/uv#15816)) - Document cache-keys for native build backends ([#15811](astral-sh/uv#15811)) - Add documentation for dependency group `requires-python` ([#14282](astral-sh/uv#14282)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

harsh-ps-2003 added 2 commits August 29, 2025 21:38

Enhance trusted publishing support for GitLab CI

2fed864

test nit

de660d5

konstin requested review from konstin and woodruffw August 29, 2025 17:11

konstin added the enhancement New feature or improvement to existing functionality label Aug 29, 2025

konstin self-assigned this Aug 29, 2025

woodruffw reviewed Aug 29, 2025

View reviewed changes

crates/uv-static/src/env_vars.rs Outdated Show resolved Hide resolved

crates/uv-static/src/env_vars.rs Outdated Show resolved Hide resolved

woodruffw reviewed Aug 29, 2025

View reviewed changes

crates/uv-publish/src/trusted_publishing.rs Outdated Show resolved Hide resolved

harsh-ps-2003 added 3 commits August 30, 2025 00:09

Add audience endpoint mocks for PyPI and TestPyPI in GitLab trusted p…

71c6e3e

…ublishing tests

fmt nit

50864a3

woodruffw reviewed Aug 29, 2025

View reviewed changes

crates/uv-publish/src/trusted_publishing.rs Outdated Show resolved Hide resolved

crates/uv-publish/src/trusted_publishing.rs Outdated Show resolved Hide resolved

woodruffw reviewed Aug 29, 2025

View reviewed changes

crates/uv-publish/src/trusted_publishing.rs Outdated Show resolved Hide resolved

woodruffw reviewed Aug 29, 2025

View reviewed changes

crates/uv-publish/src/trusted_publishing.rs Outdated Show resolved Hide resolved

harsh-ps-2003 added 4 commits August 30, 2025 01:28

error nit

612bed1

Prefer HTTPS for OIDC minting; allow HTTP only in test builds

ad50d9e

test refactor

9ff70c1

nit

527108d

konstin assigned woodruffw and unassigned konstin Sep 8, 2025

konstin removed their request for review September 8, 2025 15:52

woodruffw added 6 commits September 9, 2025 15:53

switch to ambient_id for OIDC token discovery

655c7b7

Signed-off-by: William Woodruff <[email protected]>

Merge branch 'main' into gitlab

699b54d

fix clippy findings

cc12bcf

Signed-off-by: William Woodruff <[email protected]>

fix some tests

be876cd

Signed-off-by: William Woodruff <[email protected]>

fix remaining tests

170fe8e

Signed-off-by: William Woodruff <[email protected]>

bump docs, run full clippy

167062d

Signed-off-by: William Woodruff <[email protected]>

woodruffw reviewed Sep 9, 2025

View reviewed changes

crates/uv-publish/src/trusted_publishing.rs Show resolved Hide resolved

woodruffw reviewed Sep 9, 2025

View reviewed changes

crates/uv-publish/src/lib.rs Show resolved Hide resolved

bump ambient_id

1c95e95

Signed-off-by: William Woodruff <[email protected]>

woodruffw marked this pull request as ready for review September 9, 2025 21:07

woodruffw requested a review from konstin September 9, 2025 21:08

woodruffw mentioned this pull request Sep 9, 2025

Support Gitlab CI/CD as a trusted publisher #12754

Closed

konstin reviewed Sep 10, 2025

View reviewed changes

crates/uv/tests/it/publish.rs Show resolved Hide resolved

crates/uv-publish/src/trusted_publishing.rs Outdated Show resolved Hide resolved

crates/uv-publish/src/trusted_publishing.rs Outdated Show resolved Hide resolved

crates/uv-publish/src/trusted_publishing.rs Show resolved Hide resolved

woodruffw mentioned this pull request Sep 10, 2025

feat: expose detection error types astral-sh/ambient-id#15

Merged

woodruffw added 4 commits September 10, 2025 10:45

specialize GitHub permissions error case rendering

4ee48ae

Signed-off-by: William Woodruff <[email protected]>

push IdToken further into params

ea4d25d

Signed-off-by: William Woodruff <[email protected]>

improve suggestion on NoToken

2a33439

Signed-off-by: William Woodruff <[email protected]>

bump snapshot

d272484

Signed-off-by: William Woodruff <[email protected]>

woodruffw requested a review from konstin September 10, 2025 15:46

konstin approved these changes Sep 10, 2025

View reviewed changes

woodruffw added 2 commits September 10, 2025 14:20

Merge remote-tracking branch 'origin/main' into gitlab

c800f63

docs: update trusted publishing docs to include GitLab CI/CD

f1dc54d

Signed-off-by: William Woodruff <[email protected]>

woodruffw merged commit 5f2871e into astral-sh:main Sep 11, 2025
149 of 160 checks passed

harsh-ps-2003 deleted the gitlab branch September 12, 2025 16:41

BrewTestBot mentioned this pull request Sep 17, 2025

uv 0.8.18 Homebrew/homebrew-core#244543

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Support Gitlab CI/CD as a trusted publisher #15583

Support Gitlab CI/CD as a trusted publisher #15583

Uh oh!

harsh-ps-2003 commented Aug 29, 2025 •

edited by woodruffw

Loading

Uh oh!

woodruffw left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

woodruffw commented Sep 8, 2025

Uh oh!

harsh-ps-2003 commented Sep 8, 2025

Uh oh!

Uh oh!

woodruffw Sep 9, 2025

Uh oh!

Uh oh!

woodruffw commented Sep 9, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

woodruffw commented Sep 10, 2025

Uh oh!

konstin left a comment

Uh oh!

Uh oh!

woodruffw commented Sep 11, 2025

Uh oh!

Uh oh!

Support Gitlab CI/CD as a trusted publisher #15583

Support Gitlab CI/CD as a trusted publisher #15583

Uh oh!

Conversation

harsh-ps-2003 commented Aug 29, 2025 • edited by woodruffw Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

woodruffw left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

woodruffw commented Sep 8, 2025

Uh oh!

harsh-ps-2003 commented Sep 8, 2025

Uh oh!

Uh oh!

woodruffw Sep 9, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

woodruffw commented Sep 9, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

woodruffw commented Sep 10, 2025

Uh oh!

konstin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

woodruffw commented Sep 11, 2025

Uh oh!

Uh oh!

harsh-ps-2003 commented Aug 29, 2025 •

edited by woodruffw

Loading